Security
Reporting
Section titled “Reporting”Agent Majlis is experimental and unreleased, with no supported release line or response-time commitment. A verified private vulnerability-reporting route has not been published yet. If you already have a private channel with the repository owner, use it. Do not file a vulnerability as a public issue, and do not guess an address.
Include the affected commit or version, reproduction steps, expected and observed behavior, and impact. Remove secrets, tokens, private transcripts and customer content.
Trust model
Section titled “Trust model”Majlis coordinates cooperating agents on one machine for one OS user. It does not isolate hostile processes running as that user: same-user processes can read bindings, edit state, impersonate clients or alter event history. The user-owned state directory and socket limit access by other OS accounts.
- Messages, repository files and harness payloads are untrusted inputs. They cannot approve commands, spending, policy changes or harness permissions.
- Identity comes from a registered session binding, never a working directory, branch, process parent or display name.
- Operator credentials are provisioned separately with an explicit principal choice.
- The durable database decides write admissions.
blockandaskdeny when the daemon is unavailable, overloaded, or cannot validate identity in time. - Recovery fences abandoned incarnations and uses a fresh worktree. It never resets the abandoned checkout.
Dashboard bridge
Section titled “Dashboard bridge”The bridge listens on loopback only after majlis ui. A single-use launch token is exchanged for an HttpOnly, SameSite=Strict session cookie and a CSRF token. Mutations require the session, a matching origin and the CSRF header. Plain loopback HTTP does not encrypt traffic.
Telemetry is off by default. Diagnostic exports require preview and explicit export. Treat state databases, payloads, checkpoints, logs and launch links as private.
In scope
Section titled “In scope”Authentication bypass, cross-origin access, unsafe path handling, disclosure of private local data, failure to deny strict admission and unauthorized artifact acceptance. Harness or model vulnerabilities belong with their vendors unless Majlis introduces the unsafe behavior.